Government Security
Network Security Resources

Jump to content

Photo

How Cut The Dos Header From Any Exe File

- - - - -
  • Please log in to reply
33 replies to this topic

#1 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 26 January 2006 - 05:12 AM

Hi,
Win32 files donīt need the dos header from an executable.

My question: "how i can does del the dos header from any exefile that still executable" ?



regards,
herman2k

#2 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 26 January 2006 - 07:36 AM

You want to actually remove it so it reads MZPE? There is a packer which does MZ<imports> (will have to find out the name for you cant remember which one it was). Doing it manually is an extremely difficult task because obviously the offsets will be seriously messed up.

#3 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 27 January 2006 - 03:57 AM

Hi kbnet,
I thinks u mean the packer Expressor.
When i cut/del the dos header, i believes i must reloc the offsets
but how i do that ?

regards,
herman2k

#4 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 28 January 2006 - 05:45 AM

OK, well you can cut the MZ header only so far (roughly have of the typical MZ header and the stub). The reason you can cut the whole thing out is because the MZ header contains a pointer (at 3Ch) to the PE header, so if you remove all of the MZ header so that the file reads MZPE the actually pointer to the PE header will actually be inside the PE header and the field it will be pointing to will be the imagebase in the PE header so if you do change that value to point to the PE header then you have just screwed the imagebase so the file will be corrupt. What i would recommend is cutting the bytes between the pointer to the PE header and upto the actual PE header tag. Any bytes you remove must be then placed AFTER the section table so all the offsets are corrected.

When i get a spare 15 mins I will try and put a video together for you unless you understand that all ok?

#5 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 28 January 2006 - 07:22 AM

That would be great when u make for me a video :)

Here iīve attached some examples

With dos-header:
Posted Image

Without dos-header:
Posted Image


but i think, u know what i mean!


best regards,
herman2k

#6 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 28 January 2006 - 08:53 AM

So have you got it working now? At first glance it looks ok, your pointer to the PE header seems fine. Did you pad it out (insert some bytes) after the section table so the offsets are corrected? Thinking about it you should be able to store the pointer to the PE header in the Major/Minor link version field of the PE header, thats probably the best your gona be able to get.

EDIT: Just out of interest what are you trying to achieve?

Cheers

#7 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 28 January 2006 - 10:21 AM

Hey bro, the files was created with the packer expressor

File1 :Only packed (with dos-header)
File2 : packed and cut dos-header

I need still u video :)


Cya

#8 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 29 January 2006 - 11:29 PM

OK, will try and get round to making the video for you this week.

#9 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 30 January 2006 - 02:18 AM

very good, iīm waiting :)

#10 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 30 January 2006 - 03:08 AM

do u understand the explanation though? If you do you really should have no problem doing it manually. (it will just save me making a video). Have you given it a go?

#11 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 30 January 2006 - 03:56 AM

I canīt do it manually, i need u help!

Iīve Olldbg & Hview...

#12 kbnet

kbnet

    Master Sergeant

  • Sergeant Major
  • 800 posts

Posted 30 January 2006 - 04:10 AM

What do you need ollydbg for? You just need a decent hex editor like Hex Workshop. I will *try* and get the video done 2nite bud. Why are you so desperate to learn how to do this though? If your thinking it will make malware undetected it wont.

#13 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 30 January 2006 - 04:51 AM

Of course iīm not thinking its make malware undetected :)

#14 linux_dude

linux_dude

    Staff Sergeant

  • Members
  • 343 posts

Posted 30 January 2006 - 03:19 PM

So what was the point of doing this?

#15 herman2k

herman2k

    Private First Class

  • Members
  • 41 posts

Posted 31 January 2006 - 12:37 AM

More knowlege about the PE format!